domains / families / security / implementing-ot-incident-response-playbook

implementing-ot-incident-response-playbook

separate

'Develops OT-specific incident response playbooks using a SANS PICERL-based Python

When to use

• When building OT-specific incident response procedures for the first time
• When existing IT IR playbooks do not address ICS/SCADA-specific requirements
• When preparing for OT ransomware scenarios like EKANS or LockerGoga
• When aligning IR procedures with IEC 62443 and NERC CIP incident reporting requirements
• When conducting post-incident reviews to improve OT IR capabilities

When not to use

• IT-only incident response without OT components
• day-to-day OT security monitoring
• tabletop exercise design

Skill page

Source